This issue was found with the help of AI, namely GPT-6 Astra.

In skilled hands, AI is an extraordinary tool for detecting bugs, unsoundness, and security vulnerabilities.

*Everything* is buggy, it turns out. Neither people nor AI are above writing buggy code — and now we have ability to find many of those bugs.

You don't have to use AI to write code if you don't want to. But know that the bar for quality and correctness will go *up* as a result of skilled AI use, and most of that AI use will be far more interesting than just writing new code.

#rust #rustlang #security

GitHub Actions + Rust's Miri can leak your secrets in CI 🧵

If you run Miri in CI:
- upgrade to the 2026-09-22 nightly
- clear caches
- rotate any secrets that the `cargo miri` CI job had access to

https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/

#rust #rustlang #miri #githubactions #security #vulnerability

Alt...

GitHub Actions makes it possible to cache directories between runs. Typical setups allow CI runs on main (and other branches) to write to cache, and PRs can only read from cache (preventing cache poisoning). Rust projects tend to speed up CI by caching binaries built by cargo install and sometimes the contents of target/. PR CI can be triggered by anyone who can open PRs on your repository. GitHub requires maintainer approval for the first PR, but future PRs will rerun CI on every push. Anyone who has previously landed a change can trigger a CI run extracting information from cached target/ and then cover their tracks by pushing a second commit to the PR. GitHub sometimes hides overwritten commits in its UI, making this kind of attack harder to detect. CI run logs and overwritten commits are also deleted after a few months. When cargo miri is invoked, Miri needs to retain build-relevant environment variables between runs. The current code to do so achieves this by storing all environment variables to target/. This, of course, persists when target/ is cached. If your environment contained secrets, these can now be accessed by PRs via the cache.

SambaNovaSystems is hiring Software Architect - SambaStack

🔧 #golang #python #rust #kubernetes #solutionsarchitect
🌎 Bengaluru, Karnataka
⏰ Full-time
🏢 SambaNovaSystems

Job details https://jobsfordevelopers.com/jobs/software-architect-sambastack-at-sambanova-ai-aug-20-2026-01b498?utm_source=mastodon.world&utm_medium=social&utm_campaign=posting
#jobalert #jobsearch #hiring

(more Linux and FOSS news in previous posts of thread)

Zed v1.20 adds Markdown previews and custom window titles:
https://alternativeto.net/news/2026/9/zed-v1-20-adds-markdown-previews-and-custom-window-titles/

Rune (IDE with AI capabilities) Goes Open Source, Looks to Share Revenue With Contributors:
https://feed.itsfoss.com/link/24361/17462499/rune-open-source-ide

Microsoft’s open-source CLI text editor adds syntax highlighting:
https://www.omgubuntu.co.uk/2026/09/microsoft-edit-2-0-update

Java 27 brings major post-quantum security leap, G1 garbage collector by default, and more:
https://alternativeto.net/news/2026/9/java-27-brings-major-post-quantum-security-leap-g1-garbage-collector-by-default-and-more/

Swift 6.4 brings better interoperability, faster performance, and Swift Build by default:
https://alternativeto.net/news/2026/9/swift-6-4-brings-better-interoperability-faster-performance-and-swift-build-by-default/

MariaDB 13.0.2 Now Stable: DuckDB Engine and What Changes:
https://www.linuxcompatible.org/story/mariadb-1302-now-stable-duckdb-engine-and-what-changes/

Laravel MCP 1.0 brings searchable tools to agents:
https://alternativeto.net/news/2026/9/laravel-mcp-1-0-brings-searchable-tools-to-agents/

Mojo 1.1 Released, Now Accepting Community Contributions To The Compiler:
https://www.phoronix.com/news/Mojo-1.1-Released

Rust Issues Warning Over Key Developers Being Targeted For Compromise:
https://www.phoronix.com/news/Rust-Developers-Targeted

Rustls 0.23.45 Released To Fix Two Year Old Security Issue:
https://www.phoronix.com/news/Rustls-0.23.45-Released

NGINX 1.30.5 and 1.31.6 Released: Patch for HTTP/3 Buffer Overflow (CVE-2026-90439):
https://www.linuxcompatible.org/story/nginx-1305-and-1316-released-patch-for-http-3-buffer-overflow-cve202690439/

Nextcloud Hub 26 Summer adds Teams workspaces and brings Euro-Office to desktop:
https://alternativeto.net/news/2026/9/nextcloud-hub-26-summer-adds-teams-workspaces-and-brings-euro-office-to-desktop/

GrapheneOS Isn't Happy With Google Over Pixel's Widening Head Start:
https://feed.itsfoss.com/link/24361/17466072/grapheneos-android-17-qpr1-fiasco

VirtualBox 7.2.18 Released with Linux 7.3 Fixes, Support for RHEL 10.3 Kernel:
https://9to5linux.com/virtualbox-7-2-18-released-with-linux-7-3-fixes-support-for-rhel-10-3-kernel

Valve Quietly Open-Sources Its Android Compatibility Layer:
https://feed.itsfoss.com/link/24361/17465915/valve-lepton

SDL3 Ported To HarmonyOS / OpenHarmony:
https://www.phoronix.com/news/SDL3-Ported--To-HarmonyOS

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Zed #RuneIDE #IDE #TextEditor #Java #Swift #MariaDB #Laravel #LaravelMCP #Mojo #Rust #Rustls #NGINX #Nextcloud #NextcloudHub #GrapheneOS #VirtualBox #Lepton #SDL #SDL3 #HarmonyOS #OpenHarmony #Programming #Development #Coding #ProgrammingLanguage #CustomRom #OS #Dev #FosseryTech

(more Linux and FOSS news in previous posts of thread)

Zed v1.20 adds Markdown previews and custom window titles:
https://alternativeto.net/news/2026/9/zed-v1-20-adds-markdown-previews-and-custom-window-titles/

Rune (IDE with AI capabilities) Goes Open Source, Looks to Share Revenue With Contributors:
https://feed.itsfoss.com/link/24361/17462499/rune-open-source-ide

Microsoft’s open-source CLI text editor adds syntax highlighting:
https://www.omgubuntu.co.uk/2026/09/microsoft-edit-2-0-update

Java 27 brings major post-quantum security leap, G1 garbage collector by default, and more:
https://alternativeto.net/news/2026/9/java-27-brings-major-post-quantum-security-leap-g1-garbage-collector-by-default-and-more/

Swift 6.4 brings better interoperability, faster performance, and Swift Build by default:
https://alternativeto.net/news/2026/9/swift-6-4-brings-better-interoperability-faster-performance-and-swift-build-by-default/

MariaDB 13.0.2 Now Stable: DuckDB Engine and What Changes:
https://www.linuxcompatible.org/story/mariadb-1302-now-stable-duckdb-engine-and-what-changes/

Laravel MCP 1.0 brings searchable tools to agents:
https://alternativeto.net/news/2026/9/laravel-mcp-1-0-brings-searchable-tools-to-agents/

Mojo 1.1 Released, Now Accepting Community Contributions To The Compiler:
https://www.phoronix.com/news/Mojo-1.1-Released

Rust Issues Warning Over Key Developers Being Targeted For Compromise:
https://www.phoronix.com/news/Rust-Developers-Targeted

Rustls 0.23.45 Released To Fix Two Year Old Security Issue:
https://www.phoronix.com/news/Rustls-0.23.45-Released

NGINX 1.30.5 and 1.31.6 Released: Patch for HTTP/3 Buffer Overflow (CVE-2026-90439):
https://www.linuxcompatible.org/story/nginx-1305-and-1316-released-patch-for-http-3-buffer-overflow-cve202690439/

Nextcloud Hub 26 Summer adds Teams workspaces and brings Euro-Office to desktop:
https://alternativeto.net/news/2026/9/nextcloud-hub-26-summer-adds-teams-workspaces-and-brings-euro-office-to-desktop/

GrapheneOS Isn't Happy With Google Over Pixel's Widening Head Start:
https://feed.itsfoss.com/link/24361/17466072/grapheneos-android-17-qpr1-fiasco

VirtualBox 7.2.18 Released with Linux 7.3 Fixes, Support for RHEL 10.3 Kernel:
https://9to5linux.com/virtualbox-7-2-18-released-with-linux-7-3-fixes-support-for-rhel-10-3-kernel

Valve Quietly Open-Sources Its Android Compatibility Layer:
https://feed.itsfoss.com/link/24361/17465915/valve-lepton

SDL3 Ported To HarmonyOS / OpenHarmony:
https://www.phoronix.com/news/SDL3-Ported--To-HarmonyOS

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Zed #RuneIDE #IDE #TextEditor #Java #Swift #MariaDB #Laravel #LaravelMCP #Mojo #Rust #Rustls #NGINX #Nextcloud #NextcloudHub #GrapheneOS #VirtualBox #Lepton #SDL #SDL3 #HarmonyOS #OpenHarmony #Programming #Development #Coding #ProgrammingLanguage #CustomRom #OS #Dev #FosseryTech

#Microsoft anoints #Rust as a 'Tier 1' internal language

https://www.theregister.com/devops/2026/09/11/microsoft-anoints-rust-as-a-tier-1-internal-language/5295732

#cybersecurity #Windows

Union vs sum types https://lobste.rs/s/cummnx #plt #rust
https://viralinstruction.com/posts/uniontypes/

I was able to serve files directly off the SD card today with #RadioFreeLibrary.

The embedded-sdmmc filesystem module only does 8.3 filenames though. It really is going to be like an old school BBS!

I'm going to try and see if I can serve zif files next, for an offline #wikipedia. No idea yet if I'll have enough buffer to work with, or if the crates will no_std.

#rust #esp32

When Linus Torvalds said regarding #Rust in the #Linux #kernel : "The guarantees that Rust give you only apply in the Rust-only parts of your code base, and wherever you interact with C code, all bets are off" (given that most #Rust code in Linux interfaces with "core kernel C code"), he was speaking the absolute truth. #Rust requires wrappers to interface with C (and this is quite problematic and tedious to maintain).

In this regard, #Zig would be a better alternative (because it interfaces with C without wrappers), and I personally appreciate Andrew Kelley's views.

the reason #rust builds are so slow is that rustc is not a compiler, it is a theorem prover that happens to output a binary

this is why comparing rust's build times to #zig's makes very little sense. the two languages serve fundamentally different purposes

not in terms of the type of programs they can be used to write -- both are systems languages -- but in terms of the interface they present to, and thus the thought patterns they impose on, the programmer

love that #Matrix has a #Sable client written in #Rust, but what does it mean that a movie has a video game written in another video game? doesn't check out

Is your company currently hiring for a role that includes using Rust?

Reply with a link to the opening and any relevant context.

If you're not, we'd appreciate a repost for visibility

#rust #rustlang #programming

Saving another 100TB of RAM with math (and Rust) https://lobste.rs/s/meo3ou #performance #rust
https://blog.cloudflare.com/saving-100-tb-of-ram-with-math/

New post announcement!! 🙌🏻

Reproducing and visualizing the ABA problem that comes up when working with pointers on lock-free code. This is what crossbeam-epoch solves. Lots of diagrams included!! (broke my brain fighting the mermaid diagrams to get them to render properly on my hugo site. sight.)

https://sofiabelen.github.io/projects/visualizing-the-aba-problem

#rust #lockfree #concurrency #crossbeam #opensource

I did #opensource thing for simple program I needed.

You can find it here:

https://codeberg.org/pecet/organized-copy

Basically what it does is to copy files organized like such:

A/Anime.zip
A/Argon.zip
B/Butts.zip
Z/zip.zip

Also can unzip files too, because why not.

#rust

Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

Indicators extracted from public reporting. Source: https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and

Pulse ID: 6aad5f055d32847bd7fef87b
Pulse Link: https://otx.alienvault.com/pulse/6aad5f055d32847bd7fef87b
Pulse Author: CyberHunter_NL
Created: 2026-09-18 15:55:49

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #GitHub #Rust #TransparentTribe #OTX #CyberHunter_NL

I'm back from holidays and it's Friday again so it's time for another update on Diesel, a ORM and query-builder for Rust.

I spend a bit of time filling some ideas as issues, to coordinate work with others. If you are interesting in working on an of them please reach out. That results in 8 new issues since the last update. At the same time I performed some triage and closed quite a few old already addressed issues. Additionally we received 19 pull requests this week.

#rust #rustlang

I made a new thing as an experiment:

https://github.com/0xdea/singsing-rs

It’s a blazing-fast IPv4/TCP port scanning library + port scanner for Linux, a #Rust port of the venerable singsing/zucca.

Shout out for someone I noticed and his toolkit @ratatui_rs. Each time I thought "cool, but no use for me yet". That changed now I started with #rust. I will definitely create some terminal apps, so it won't take long to start using ratatui 😄

The YT algorithm showed me an interview with the author @orhun - what a friendly personality! He is using Arch, BTW.

https://youtu.be/LGrx9ueO3y0

Check out this friendly developer and his projects. From one open source dev to another: Thanks for your work ❤️

Bitfinex is hiring Senior Backend Developer - Node.js (Fully Remote, Worldwide)

🔧 #node #cplusplus #javascript #ruby #rust #api #blockchain #mongodb #mysql #redis #seniorengineer
🌎 Remote
⏰ Full-time
🏢 Bitfinex

Job details https://jobsfordevelopers.com/jobs/senior-backend-developer-node-js-fully-remote-worldwide-at-bitfinex-com-mar-2-2026-ddc51e?utm_source=mastodon.world&utm_medium=social&utm_campaign=posting
#jobalert #jobsearch #hiring

Any tips (or links) for fuzzing with f64 parameters?
#rust #fuzzing

Cloudflare is hiring Senior Distributed Systems Engineer - Cache

🔧 #c #cplusplus #golang #rust #api #kafka #kubernetes #postgresql #seniorengineer
🌎 Remote
⏰ Full-time
🏢 Cloudflare

Job details https://jobsfordevelopers.com/jobs/senior-distributed-systems-engineer-cache-at-cloudflare-com-sep-9-2026-392121?utm_source=mastodon.world&utm_medium=social&utm_campaign=posting
#jobalert #jobsearch #hiring

Vortex: One Format for Any Shape https://lobste.rs/s/tfsojd #databases #rust
https://spiraldb.com/blog/vortex-one-format-for-any-shape

RE: https://social.rust-lang.org/@rust/117288095334006877

We are definitely seeing some shit. Be alert, but not alarmed. #Rust

AI — Actually, Ivan 🦀 🤖 boosted

Rust Language » 🌐 2026-09-17
@rust@social.rust-lang.org

⚠️ We believe that there is an ongoing campaign targeting owners of popular crates and rust-lang team members that is attempting to compromise devices and accounts in order to use them to publish malware.

See our blog post for details: https://blog.rust-lang.org/2026/09/17/targeted-attacks/

Be alert: targeted attacks on prominent Rustaceans https://lobste.rs/s/uz30ed #rust #security
https://blog.rust-lang.org/2026/09/17/targeted-attacks/

Labeled matches: why is this not in every regex engine? https://lobste.rs/s/7d6sh9 #performance #rust
https://iev.ee/blog/categorize-everything-all-at-once/

The Golden Spike, and Resurrecting the Vale(n) Programming Language https://lobste.rs/s/fjnkn4 #plt #rust
https://verdagon.dev/blog/golden-spike-reviving-vale-valen

Developing provably correct Rust code with Verus https://lobste.rs/s/yyijiq #rust
https://www.amazon.science/blog/developing-provably-correct-rust-code-with-verus

matched cell highlighting. ✨

still completely broken on large tables due to cell reuse. need to figure that out, but I like how this looks!

#linux #gnome #circle #rust #sql #sqlite

Ubuntu schließt Rust-Umstieg ab

Ubuntu 26.10 migriert alle Standard-Coreutils auf Rust. Auch cp, mv und rm sind nun enthalten.

https://www.heise.de/news/Ubuntu-schliesst-Rust-Umstieg-ab-11456307.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Systemverwaltung #Betriebssystem #IT #OpenSource #Rust #Security #Ubuntu #news

#WhatCouldGoWrong #Rust

Alt...

Screenshot of a blog post from Copilot entitled "Migrating the GitHub Copilot runtime to Rust, using Copilot" with subtitle "A rewrite this size wasn't affordable before agents.Here's what porting the Copilot runtime to 800,000 lines of production Rust actually took."

Alt...

Meme with Buzz showing the sky to Woody : "Unwrap... Unwrap everywhere..."

oproxy v0.1.11 released

https://secburg.com/posts/oproxy-v0111-released/

#oproxy #Rust #OpenSource #InfoSec

This Week's Project Spotlight 🦀

rust-smallvec

Small vector optimization for Rust: store up to a small number of items on the stack.

#rustlang #rust

maglev consistent hashing in rust https://lobste.rs/s/degdmj #networking #rust
https://andreashohmann.com/maglev-consistent-hashing-in-rust/

Why building a Rust LSP is hard https://lobste.rs/s/q35pnm #compilers #editors #rust #vibecoding
https://rust-glancer.github.io/blog/why-lsp-is-hard/

search seems to work! 🥳

some polish left to do:
- the number column width shouldn't cause shifts
- needs a "no results" state
- UI blocks, but only noticeable on huge tables

the toolbar expands to show the search entry as per the #GNOME HIG, but I'm thinking about replacing the file name to keep it minimalist. thoughts?

#linux #circle #bobby #rust #sql #sqlite

Ubuntu 26.10 completes transition to Rust-based coreutils https://lobste.rs/s/ynjgbz #rust
https://www.omgubuntu.co.uk/2026/09/ubuntu-2610-rust-coreutils-complete

Some things Veloren does differently via @lesley https://lobste.rs/s/zutlqt #games #graphics #rust
https://blog.jsbarretto.com/post/veloren